Add org.opencontainers.image.source.subpath

[evankanderson]

Fixes #1046

Defines an additional subpath within the source repository. In combination with the source attribute, this functions as a correlation ID for multiple images produces from the same source repository (e.g. the different containers produced by https://github.com/knative/serving, or any other mono-repo type arrangement which builds related artifacts from a common source tree).

source.subpath is explicitly tool-specific; I'd expect that most source repositories use a single tool for building images, or at the very least don't use two tools with the same subpath value to produce different images. There's probably at least one awesome counter-example out there... I don't know if I want to see it.

[tianon]

(soft) NACK; #1046 (comment)

(Soft because I'm still willing to be convinced, but I think we need more spec maintainer opinions to be expressed for this to really move one way or the other)

[sudo-bmitch]

I think we have three options here depending on what we want to do:

1. Decline this and use a tool specific annotation (e.g. something like io.buildpacks.source.subpath) if the goal is to have that tool define unique builds.
2. Change this to org.opencontainers.image.instance or some other unique key to dedup multiple builds in the same source repo. The value would be free form, based on the build tooling. E.g. makefiles may specify a target name. And docker builds may include the context, dockerfile, target, platform, build args, and any other inputs.
3. Leave this proposal as is, but make it generic and remove any expected results since different tooling will use it in ways that do not guarantee it is a unique build within the git repo. With other popular build tools, two different images can be built from the same subpath by altering other inputs.

Note, the DCO is also failing on this and would need to be fixed before we can consider merging.

[tianon]

I'm still partial to Brandon's option 1 (have each tool define their own additional fields for uniqueness if that's a property that they want/need instead of relying on us to somehow be the arbiter of all the possible uniqueness vectors for every build tool). 🙈 ❤️